Method for providing log information, electronic device, and computer program product

ABSTRACT

Embodiments of the present disclosure relate to a method for providing log information, an electronic device, and a computer program product. A method for providing log information includes: determining a first set of semantic segments including fault information from multiple semantic segments into which a set of log files of a target system is divided; extracting key information specific to the target system from the first set of semantic segments; determining, based on the extracted key information, an application scenario involved in the fault information and at least one log file related to the application scenario in the set of log files; determining a second set of semantic segments including the key information from multiple semantic segments into which the at least one log file is divided; and providing the first set of semantic segments and the second set of semantic segments by highlighting the fault information and the key information in the first set of semantic segments and the second set of semantic segments. The embodiments of the present disclosure contribute to improving the efficiency of a user in locating the cause of a system fault, thereby improving user satisfaction.

TECHNICAL FIELD

Embodiments of the present disclosure generally relate to the field ofcomputers, and more particularly, to a method for providing loginformation, an electronic device, and a computer program product.

BACKGROUND

When a computer system (for example, a data backup system) is faulty,users (for example, system administrators or technical support staff)usually need to collect relevant log files in different folders, andthen analyze the log files to locate the cause of the fault. However,log files may be massive. In addition, some log files may be quicklyoverwritten. This results in inefficiency in locating the cause of thefault by analyzing the log files.

SUMMARY OF THE INVENTION

Embodiments of the present disclosure provide a method for providing loginformation, an electronic device, and a computer program product.

In a first aspect of the present disclosure, a method for providing loginformation is provided. The method includes: determining a first set ofsemantic segments including fault information from multiple semanticsegments into which a set of log files of a target system is divided;extracting key information specific to the target system from the firstset of semantic segments; determining, based on the extracted keyinformation, an application scenario involved in the fault informationand at least one log file related to the application scenario in the setof log files; determining a second set of semantic segments includingthe key information from multiple semantic segments into which the atleast one log file is divided; and providing the first set of semanticsegments and the second set of semantic segments by highlighting thefault information and the key information in the first set of semanticsegments and the second set of semantic segments.

In a second aspect of the present disclosure, an electronic device isprovided. The device includes a processor and a memory. The memory iscoupled to the processor and stores instructions for execution by theprocessor. The instructions, when executed by the processor, cause thedevice to perform actions. The actions include: determining a first setof semantic segments including fault information from multiple semanticsegments into which a set of log files of a target system is divided;extracting key information specific to the target system from the firstset of semantic segments; determining, based on the extracted keyinformation, an application scenario involved in the fault informationand at least one log file related to the application scenario in the setof log files; determining a second set of semantic segments includingthe key information from multiple semantic segments into which the atleast one log file is divided; and providing the first set of semanticsegments and the second set of semantic segments by highlighting thefault information and the key information in the first set of semanticsegments and the second set of semantic segments.

In a third aspect of the present disclosure, a computer program productis provided. The computer program product is tangibly stored on anon-transitory computer storage medium and includes machine-executableinstructions. When executed by a device, the machine-executableinstructions cause the device to perform the method described accordingto the above first aspect.

In a fourth aspect of the present disclosure, a computer-readablestorage medium is provided. A computer program is stored thereon. Whenexecuted by a processor, the program implements the method describedaccording to the above first aspect.

The Summary section is provided to introduce the selection of conceptsin a simplified form, which will be further described in the detaileddescription below. The Summary section is neither intended to identifykey features or essential features of the present disclosure, norintended to limit the scope of the present disclosure.

BRIEF DESCRIPTION OF THE DRAWINGS

The above and other objectives, features and advantages of the presentdisclosure will become more apparent by describing example embodimentsof the present disclosure in detail with reference to the accompanyingdrawings, and in the example embodiments of the present disclosure, thesame reference numerals generally represent the same components.

FIG. 1 illustrates a block diagram of an example environment in whichembodiments of the present disclosure can be implemented;

FIG. 2 illustrates a flowchart of an example method for providing loginformation according to embodiments of the present disclosure;

FIGS. 3A and 3B respectively illustrate log segments includinghighlighted fault information and system key information according toembodiments of the present disclosure; and

FIG. 4 illustrates a schematic block diagram of an example electronicdevice that may be used to implement embodiments of the presentdisclosure.

In each figure, the same or corresponding reference numerals representthe same or corresponding parts.

DETAILED DESCRIPTION

Preferred embodiments of the present disclosure will be described inmore detail below with reference to the accompanying drawings. Althoughpreferred embodiments of the present disclosure are illustrated in theaccompanying drawings, it should be understood that the presentdisclosure may be implemented in various forms and should not be limitedby the embodiments illustrated herein. Rather, these embodiments areprovided to make the present disclosure more thorough and complete, andwill fully convey the scope of the present disclosure to those skilledin the art.

The term “include” and its variants as used herein are open-ended, i.e.,“including but not limited to.” Unless specifically stated, the term“or” means “and/or.” The term “based on” means “based at least in parton.” The terms “one example embodiment” and “one embodiment” mean “atleast one example embodiment.” The term “another embodiment” means “atleast one additional embodiment.” The terms “first,” “second,” etc. mayrefer to different or identical objects. Other explicit and implicitdefinitions may be included below.

As described above, when a computer system (for example, a data backupsystem) is faulty, users (for example, system administrators ortechnical support staff) usually need to collect relevant log files indifferent folders, and then analyze the log files to locate the cause ofthe fault. However, log files may be massive. In addition, some logfiles may be quickly overwritten. This results in inefficiency inlocating the cause of the fault by analyzing the log files.

The embodiments of the present disclosure provide a scheme for providinglog information, to solve the above problems and/or other potentialproblems. According to the scheme, a first set of semantic segmentsincluding fault information is determined from multiple semanticsegments into which a set of log files of a target system is divided.Key information specific to the target system is extracted from thefirst set of semantic segments. An application scenario involved in thefault information and at least one log file related to the applicationscenario in the set of log files are determined based on the extractedkey information. A second set of semantic segments including the keyinformation is determined from multiple semantic segments into which theat least one log file is divided. The first set of semantic segments andthe second set of semantic segments are provided by highlighting thefault information and the key information in the first set of semanticsegments and the second set of semantic segments. In this way, theembodiments of the present disclosure contribute to improving theefficiency of a user in locating the cause of a system fault, therebyimproving user satisfaction.

Hereinafter, the embodiments of the present disclosure will be describedin detail with reference to the accompanying drawings. FIG. 1illustrates a block diagram of example environment 100 in whichembodiments of the present disclosure can be implemented. It should beunderstood that the structure of example environment 100 is describedfor example purposes only. The type and quantity of entities included inexample environment 100 are also shown for example purposes only,without implying any limitation on the scope of the present disclosure.The embodiments of the present disclosure may be implemented in anenvironment different from environment 100.

As shown in FIG. 1, environment 100 may include target system 110 andlog providing device 120. Examples of target system 110 may include, butare not limited to, a computing system, a data storage system, a databackup system, and the like. Target system 110 may include multiplecomponents 111-1, 111-2, . . . , 111-N (collectively referred to as“component 111,” where N is a natural number). Component 111 may be aphysical component or a logical component. Examples of component 111 mayinclude, but are not limited to, a client, a server, a storageapparatus, a software module, and the like. For example, multiplecomponents 111 may be implemented on different physical devices,respectively, or at least some components may be implemented on the samephysical device. In some embodiments, corresponding log locations formultiple components 111 may be predefined, for example, as shown inTable 1, so that multiple components 111 record logs into a log file atthe corresponding log locations when running.

TABLE 1 Predefined Log Location List Component Log Location Component111-1 C:\Program Files\avs\var\clientlogs Component 111-2/usr/local/avamar/var/mc/server_log/mcserver.* . . . Component 111-N/data01/cur/gsan.log

As shown in FIG. 1, log providing device 120 may include log collector121, log analyzer 122, and log provider 123. Log collector 121 mayacquire, from corresponding log locations predefined for multiplecomponents 111, multiple log files 101 periodically or in response to auser command. In some embodiments, log collector 121 may filter multiplecollected log files 101 to obtain a set of log files to be analyzed. Forexample, log collector 121 may filter multiple log files 101 accordingto time to obtain a set of log files that have been modified recently(for example, in the last 12 hours). Alternatively, in otherembodiments, the above filtering operation may be omitted. Log collector121 may provide the set of collected or filtered log files to loganalyzer 122 for analysis.

Log analyzer 122 may analyze a set of log files from log collector 121to mine important information therein, and intercept important segmentsfrom a long log file. In some embodiments, in order to facilitate theanalysis of the log files, log analyzer 122 may divide each log file inthe set of received log files into multiple semantic segments (alsocalled “logical segment” or “log segment”). The “semantic segment”described herein refers to a text unit having the same subject orsimilar semantics, which may include one or more paragraphs, or at leasta part of a certain paragraph. In some embodiments, log analyzer 122 mayutilize any known text segmentation algorithm or any text segmentationalgorithm to be developed in the future to divide the log file intomultiple semantic segments. Examples of text segmentation algorithmsinclude, but are not limited to, a Dotplotting algorithm, a textsegmentation algorithm improved based on the Dotplotting algorithm,and/or any other suitable text segmentation algorithms.

Log analyzer 122 may analyze multiple semantic segments into which a setof log files is divided, so as to mine key log information 102 therein.Key log information 102 may include, for example, semantic segments withfault information and/or important system information, fault profiles,additional information, and/or suggestions, and so on. Log analyzer 122may provide the obtained key log information 102 to log provider 123 andfurther to a user. Additionally or alternatively, in some embodiments,log provider 123 may also provide all log files to the user forreference by the user.

FIG. 2 illustrates a flowchart of example method 200 for providing loginformation according to embodiments of the present disclosure. Forexample, method 200 may be performed at log providing device 120 asshown in FIG. 1. It should be understood that method 200 may furtherinclude additional blocks not shown and/or omit the blocks shown, andthe scope of the present disclosure is not limited in this regard.Method 200 is described in detail below with reference to FIG. 1.

As shown in FIG. 2, at block 210, log providing device 120 (for example,log analyzer 122) determines a first set of semantic segments includingfault information from multiple semantic segments into which a set oflog files of target system 110 is divided.

In some embodiments, as described above, log analyzer 122 may utilizeany known text segmentation algorithm or any text segmentation algorithmto be developed in the future to divide a set of log files of targetsystem 110 into multiple semantic segments. Examples of textsegmentation algorithms include, but are not limited to, a Dotplottingalgorithm, a text segmentation algorithm improved based on theDotplotting algorithm, and/or any other suitable text segmentationalgorithms. For the purpose of example, the text segmentation algorithmimproved based on the Dotplotting algorithm according to an embodimentof the present disclosure is shown below. For example, the textsegmentation algorithm may be as shown in Table 2:

TABLE 2 Example Text Segmentation Algorithm Given text S, N is anoptimal number of segments; Initialize: B = {}, P = {}, Jmin = +∞, C ={i | i is a candidate segment boundary in S}, Gbest = 0; Increase thenumber of segments from 1 to N For each element i in C 1) P = B ∪ {i};2) Calculate a score of a segmentation mode P using an evaluationfunction J; 3) If Jmin > J, Jmin = J and Gbest = i; B = B ∪ {Gbest}; C =C − {Gbest}; End and output a segmentation result B

In the algorithm shown in Table 2, segment boundaries are addedsuccessively until an optimal number of segments is reached. Paragraphboundaries may serve as candidate segment boundaries. To determine a newsegment boundary, each candidate location may be checked. Assuming thata certain candidate location is added to a boundary set B andconstitutes a current segment set P, the boundary in P may be used tocalculate a value of the segmentation evaluation function J. Theboundary location that reaches a minimum value is selected as the nextboundary to be inserted into the boundary set B until the number ofboundaries is equal to N. In some embodiments, evaluation function J inthe above algorithm is expressed as follows:

$J = {{\sum_{j = 2}^{P}\frac{V_{P_{{j - 1},P_{j}}} \times V_{P_{j,n}}}{\left( {P_{j} - P_{j - 1}} \right)\left( {n - P_{j)}} \right.}} + {\sum_{j = 1}^{{p - 1}}\frac{V_{0,P_{j}} \times V_{{Pj},P_{j + 1}}}{P_{j}\left( {P_{j + 1} - P_{j}} \right)}}}$

where n is the length of an entire text, P₁ is the location of a jthsemantic segment boundary. |P| is the number of semantic segments in thetext. Vx,y is a word frequency vector of a text segment composed of anxth word to a yth word. As the similarity of two segments is lower, atheme will more probably change at the end of a paragraph between thetwo segments. In this way, it is possible to find a text segmentationmode with the smallest similarity between adjacent segments. It shouldbe understood that the above text segmentation algorithm is shown forexample purposes only, and is not intended to limit the scope of thepresent disclosure. The embodiments of the present disclosure are alsoapplicable to other text segmentation algorithms.

Log analyzer 122 may perform a fault information search on multiplesemantic segments into which a set of log files is divided. In someembodiments, before performing a fault information search on multiplesemantic segments into which a set of log files is divided, log analyzer122 may pre-process the multiple semantic segments, including but notlimited to removing timestamps, unifying case, symbolizing characterstreams, and so on. In some embodiments, log analyzer 122 may search themultiple pre-processed semantic segments for fault keywords, such aserror, warning, failure, and crash, and determine a first set ofsemantic segments based on a search result such that each semanticsegment in the first set of semantic segments includes the at least oneof the above fault keywords. Additionally or alternatively, in someembodiments, log analyzer 122 may search the multiple semantic segmentsfor a fault code based on a regular expression representing a faultcode. Log analyzer 122 may determine the first set of semantic segmentsincluding fault information according to the context of the found faultcode.

At block 220, log providing device 120 (for example, log analyzer 122)extracts key information specific to target system 110 from the firstset of semantic segments. In some embodiments, the extracted keyinformation may be information shared among multiple components 111,such as component names or identifiers, component software versions,component operating system types, session identifiers, and storageapparatus names. It should be understood that the extracted keyinformation may be different in different implementations.

In some embodiments, log analyzer 122 may extract the key informationspecific to target system 110 by searching the first set of semanticsegments for at least one keyword indicating a type of the keyinformation. Examples of keywords indicating key information types mayinclude, but are not limited to, keywords indicating componentidentifiers (such as client identifiers cid), keywords indicatingidentifiers of plug-ins in components (such as plug-in identifiers pidin a client), keywords indicating the number of plug-ins in components(such as the number of plug-ins pidnum in the client), keywords relatedto service operation types such as backup, replication, or restore, andthe like. It should be understood that in a specific implementation, thekeywords searched for may be determined according to specificrequirements, and are not limited to those listed above.

At block 230, log providing device 120 (for example, log analyzer 122)determines, based on the extracted key information, an applicationscenario involved in the fault information and at least one log filerelated to the application scenario in the set of log files.

In some embodiments, as described above, log analyzer 122 may search thefirst set of semantic segments for keywords related to a serviceoperation type, such as backup, replication, or restore, therebydetermining a service operation type related to the applicationscenario. Then, log analyzer 122 may identify the application scenariobased on the service operation type and the key information.

In some embodiments, target system 110 may predefine one or moreapplication scenarios. For example, for each predefined applicationscenario, a service operation type involved in the predefinedapplication scenario and at least one component 111 associated with thepredefined application scenario may be specified. Taking a data backupsystem as an example, examples of service operation types include, butare not limited to, full backup to a certain storage apparatus,incremental backup to a certain storage apparatus, restoration of backupdata to its original location, restoration of backup data to differentlocations, replication with incremental backup, and the like. Loganalyzer 122 may match a service operation type determined in the firstset of semantic segments with a service operation type in the predefinedapplication scenario, thereby determining in which one of one or morepredefined application scenarios is involved in the fault information.Log analyzer 122 may determine, based on at least one component 111associated with the predefined application scenario and Table 1, loglocations in which log files will be involved in the predefinedapplication scenario. In this way, log analyzer 122 can determine atleast one log file related to the application scenario in the set of logfiles.

In some embodiments, log analyzer 122 may generate a fault profilerelated to the application scenario based on a fault code extracted fromthe first set of semantic segments, the determined service operationtype, and system key information. Examples of fault profiles are shownin Table 3, which may be used as part of key log information 102 later.

TABLE 3 Example Fault Profile Client Namevm-a4dpn227d4-1.asl.lab.emc.com Service Operation Type restore onlyClient Identifier 78385d4cddd7cf0764077f8cfba96b80d79bce46 ClientOperating System N/A Storage Location N/A Client Plug-in oracle_serverIdentifier Client Software Version 19.1.100-38 Fault Code Cannot usecommand when connected to a mounted target database

At block 240, log providing device 120 or example, log analyzer 122determines a second set of semantic segments including system keyinformation from multiple semantic segments into which at least one logfile (related to the determined application scenario) is divided. Asdescribed above, log analyzer 122 may determine at least one log filerelated to the application scenario in the set of log files. In someembodiments, log analyzer 122 may search multiple semantic segments intowhich the at least one log file is divided for those key informationextracted from the first set of semantic segments.

At block 250, log providing device 120 (for example, log provider 123)provides the first set of semantic segments and the second set ofsemantic segments by highlighting the fault information and the keyinformation in the first set of semantic segments and the second set ofsemantic segments.

FIGS. 3A and 3B respectively illustrate semantic segments 310 and 320including highlighted fault information and system key informationaccording to embodiments of the present disclosure. In FIGS. 3A and 3B,highlighted system key information is shown by a dashed box, andhighlighted fault information is shown by a solid box. From faultinformation 311 shown in FIG. 3A, it is possible to determine that anAvoracle component has an error due to the abnormal termination of anRman component. Then, from fault information 321 shown in FIG. 3B, it ispossible to determine the root cause of the fault, “a command cannot beused when connecting to an installed target database.” In this way,users can determine root causes of system faults from a small amount ofkey log information without having to mine information from massive logfiles.

Additionally or alternatively, in some embodiments, log provider 123 mayprovide the fault profile shown in Table 3 while providing the first setof semantic segments and the second set of semantic segments.

Additionally or alternatively, in some embodiments, log providing device120 may further collect information related to a fault code and generatesuggestions to resolve the fault as part of key log information 102shown in FIG. 1 for users. For example, if the fault code is“insufficient memory,” log providing device 120 may acquire memory usageinformation of target system 110 and append it to key log information102. If the fault code is “stack overflow,” log providing device 120 mayacquire a kernel dump file and append it to key log information 102. Ifthe fault code is “backup task timeout,” log providing device 120 mayacquire information such as the resource usage of target system 110 oran execution time of other tasks, and append it to key log information102.

Additionally or alternatively, in some embodiments, log providing device120 may package all the obtained log files and the extracted varioustypes of information, and provide it together with key log information102 shown in FIG. 2 to users for reference.

As can be seen from the above description, the embodiments of thepresent disclosure provide a scheme for providing log information. Thisscheme can collect corresponding log files and automatically retrievethe fault information context and the service operation context ofrelated components. Based on predefined application scenarios, the loganalyzer not only can intelligently detect log segments containing faultinformation, but also can locate internal relationships betweenfault-related components from logs of different components. In this way,the embodiments of the present disclosure contribute to improving theefficiency of a user in locating the cause of a system fault, therebyimproving user satisfaction.

FIG. 4 illustrates a schematic block diagram of example electronicdevice 400 that may be used to implement embodiments of the presentdisclosure. For example, log providing device 120 shown in FIG. 1 may beimplemented by device 400. As shown in FIG. 4, device 400 includescentral processing unit (CPU) 401 that may perform various appropriateactions and processes according to computer program instructions storedin read only memory (ROM) 402 or computer program instructions loadedfrom storage unit 408 to random access memory (RAM) 403. In RAM 403,various programs and data required for the operation of device 400 mayalso be stored. CPU 401, ROM 402 and RAM 403 are connected to each otherthrough bus 404. Input/output (I/O) interface 405 is also connected tobus 404.

Multiple components in device 400 are connected to I/O interface 405,including: input unit 406, such as a keyboard or a mouse; output unit407, such as various types of displays or speakers; storage unit 408,such as a magnetic disk or an optical disk; and communication unit 409,such as a network card, a modem, or a wireless communicationtransceiver. Communication unit 409 allows device 400 to exchangeinformation/data with other devices over a computer network such as theInternet and/or various telecommunication networks.

The various processes and processing described above, such as method200, may be performed by processing unit 401. For example, in someembodiments, method 200 may be implemented as a computer softwareprogram that is tangibly included in a machine-readable medium, such asstorage unit 408. In some embodiments, some or all of the computerprograms may be loaded and/or installed onto device 400 via ROM 402and/or communication unit 409. One or more actions of method 200described above may be performed when the computer program is loadedinto RAM 403 and executed by CPU 401.

The present disclosure may be a method, a device, a system, and/or acomputer program product. The computer program product may include acomputer-readable storage medium having computer-readable programinstructions for performing various aspects of the present disclosureloaded thereon.

The computer-readable storage medium may be a tangible device that mayretain and store instructions used by an instruction execution device.For example, the computer-readable storage medium may be, but is notlimited to, an electrical storage device, a magnetic storage device, anoptical storage device, an electromagnetic storage device, asemiconductor storage device, or any suitable combination of theforegoing. More specific examples (a non-exhaustive list) of thecomputer-readable storage medium include: a portable computer disk, ahard disk, an RAM, an ROM, an erasable programmable read-only memory(EPROM or flash memory), a static random access memory (SRAM), aportable compact disk read-only memory (CD-ROM), a digital versatiledisk (DVD), a memory stick, a floppy disk, a mechanical encoding devicesuch as a punch card or a raised structure in a groove havinginstructions recorded thereon, and any suitable combination of theforegoing. The computer-readable storage medium as used herein is not tobe interpreted as transient signals per se, such as radio waves or otherfreely propagated electromagnetic waves, electromagnetic wavespropagated through waveguides or other transmission media (e.g., lightpulses through fiber optic cables), or electrical signals transmittedthrough electrical wires.

The computer-readable program instructions described herein may bedownloaded from the computer-readable storage medium to variouscomputing/processing devices or downloaded to an external computer or anexternal storage device over a network, such as the Internet, a localarea network (LAN), a wide area network (WAN), and/or a wirelessnetwork. The network may include copper transmission cables, fiber optictransmissions, wireless transmissions, routers, firewalls, switches,gateway computers, and/or edge servers. A network adapter card ornetwork interface in each computing/processing device receives acomputer-readable program instruction from the network and forwards thecomputer-readable program instruction for storage in thecomputer-readable storage medium in each computing/processing device.

The computer program instructions for performing the operations of thepresent disclosure may be assembly instructions, instruction setarchitecture (ISA) instructions, machine instructions, machine-relatedinstructions, microcode, firmware instructions, status setting data, orsource code or object code written in any combination of one or moreprogramming languages, including object-oriented programming languagessuch as Smalltalk, C++, etc., as well as conventional proceduralprogramming languages such as a “C” language or similar programminglanguages. The computer readable program instructions can be completelyexecuted on a user computer, partially executed on a user computer,executed as a separate software package, partially executed on a usercomputer and partially executed on a remote computer, or completelyexecuted on a remote computer or a server. In the case where a remotecomputer is involved, the remote computer may be connected to a usercomputer through any type of networks, including an LAN or a WAN, or maybe connected to an external computer (e.g., connected through theInternet using an Internet service provider). In some embodiments, anelectronic circuit, such as a programmable logic circuit, a fieldprogrammable gate array (FPGA), or a programmable logic array (PLA), maybe customized by utilizing state information of the computer-readableprogram instructions. The electronic circuit may execute thecomputer-readable program instructions to implement various aspects ofthe present disclosure.

Various aspects of the present disclosure are described herein withreference to flowcharts and/or block diagrams of the method, theapparatus (system), and the computer program product according to theembodiments of the present disclosure. It should be understood that eachblock in the flowcharts and/or the block diagrams and combinations ofthe blocks in the flowcharts and/or the block diagrams may beimplemented by the computer-readable program instructions.

The computer-readable program instructions may be provided to aprocessing unit of a general purpose computer, a special purposecomputer, or other programmable data processing apparatuses, therebyproducing a machine such that when these instructions are executed bythe processing unit of the computer or other programmable dataprocessing apparatuses, an apparatus for implementing functions/actionsspecified in one or more blocks in the flowcharts and/or the blockdiagrams is generated. The computer-readable program instructions mayalso be stored in the computer-readable storage medium. Theseinstructions enable the computer, the programmable data processingapparatuses, and/or other devices to operate in a specific manner, sothat the computer-readable medium storing the instructions includes anarticle of manufacture that includes instructions for implementingvarious aspects of functions/actions specified in one or more blocks inthe flowcharts and/or the block diagrams.

The computer-readable program instructions may also be loaded onto acomputer, other programmable data processing apparatuses, or otherdevices such that a series of operational steps are performed on thecomputer, other programmable data processing apparatuses, or otherdevices to produce a computer-implemented process. Thus, theinstructions executed on the computer, other programmable dataprocessing apparatuses, or other devices implement the functions/actionsspecified in one or more blocks in the flowcharts and/or the blockdiagrams.

The flowcharts and block diagrams in the accompanying drawingsillustrate the architectures, functions, and operations of possibleimplementations of systems, methods, and computer program productsaccording to multiple embodiments of the present disclosure. In thisregard, each block in the flowcharts or block diagrams can represent fora part of a module, a program segment, or an instruction, and a part ofthe module, the program segment or the instruction includes one or moreexecutable instructions for implementing specified logical functions. Insome alternative implementations, functions labeled in the blocks mayoccur in an order different from that labeled in the accompanyingdrawings. For example, two successive blocks may actually be performedbasically in parallel, or they may be performed in an opposite ordersometimes, depending on the functions involved. It should also be notedthat each block in the block diagrams and/or flowcharts and acombination of blocks in the block diagrams and/or flowcharts can beimplemented using a dedicated hardware-based system for executingspecified functions or actions, or can be implemented using acombination of dedicated hardware and computer instructions.

Various embodiments of the present disclosure have been described above,and the foregoing description is illustrative rather than exhaustive,and is not limited to the disclosed embodiments. Multiple modificationsand variations will be apparent to those skilled in the art withoutdeparting from the scope and spirit of the illustrated variousembodiments. The selection of terms as used herein is intended to bestexplain the principles and practical applications of the variousembodiments or the technical improvements to technologies on the market,or to enable others of ordinary skill in the art to understand theembodiments disclosed here.

1. A method for providing log information, comprising: determining afirst set of semantic segments comprising fault information frommultiple semantic segments into which a set of log files of a targetsystem is divided; extracting key information specific to the targetsystem from the first set of semantic segments; determining, based onthe extracted key information, an application scenario involved in thefault information and at least one log file related to the applicationscenario in the set of log files; determining a second set of semanticsegments comprising the key information from multiple semantic segmentsinto which the at least one log file is divided; and providing the firstset of semantic segments and the second set of semantic segments byhighlighting the fault information and the key information in the firstset of semantic segments and the second set of semantic segments.
 2. Themethod according to claim 1, further comprising: acquiring multiple logfiles from corresponding log locations predefined for multiplecomponents in the target system; and obtaining the set of log files byfiltering the multiple log files.
 3. The method according to claim 1,further comprising: dividing, based on a text segmentation algorithm,each log file in the set of log files into at least one semanticsegment.
 4. The method according to claim 1, wherein determining thefirst set of semantic segments comprises: searching the multiplesemantic segments into which the set of log files is divided for a faultkeyword; and determining the first set of semantic segments based on asearch result such that each semantic segment in the first set ofsemantic segments comprises the fault keyword.
 5. The method accordingto claim 1, wherein extracting the key information from the first set ofsemantic segments comprises: extracting the key information shared amongmultiple components of the target system from the first set of semanticsegments.
 6. The method according to claim 1, wherein extracting the keyinformation specific to the target system from the first set of semanticsegments comprises: extracting the key information by searching thefirst set of semantic segments for at least one keyword indicating atype of the key information.
 7. The method according to claim 1, whereindetermining the application scenario comprises: determining, based onthe extracted key information, a service operation type related to theapplication scenario; and identifying the application scenario based onthe service operation type and the key information.
 8. The methodaccording to claim 7, wherein determining the at least one log filecomprises: determining at least one component related to the serviceoperation type from multiple components of the target system; anddetermining the at least one log file associated with the at least onecomponent from the set of log files.
 9. The method according to claim 7,further comprising: extracting a fault code related to the applicationscenario from the first set of semantic segments; generating a faultprofile related to the application scenario based on the serviceoperation type, the key information, and the fault code; and providingthe fault profile while providing the first set of semantic segments andthe second set of semantic segments.
 10. An electronic device,comprising: a processor; and a memory coupled to the processor andstoring instructions for execution by the processor, wherein theinstructions, when executed by the processor, cause the electronicdevice to perform actions, the actions comprising: determining a firstset of semantic segments comprising fault information from multiplesemantic segments into which a set of log files of a target system isdivided; extracting key information specific to the target system fromthe first set of semantic segments; determining, based on the extractedkey information, an application scenario involved in the faultinformation and at least one log file related to the applicationscenario in the set of log files; determining a second set of semanticsegments comprising the key information from multiple semantic segmentsinto which the at least one log file is divided; and providing the firstset of semantic segments and the second set of semantic segments byhighlighting the fault information and the key information in the firstset of semantic segments and the second set of semantic segments. 11.The electronic device according to claim 10, wherein the actions furthercomprise: acquiring multiple log files from corresponding log locationspredefined for multiple components in the target system; and obtainingthe set of log files by filtering the multiple log files.
 12. Theelectronic device according to claim 10, wherein the actions furthercomprise: dividing, based on a text segmentation algorithm, each logfile in the set of log files into at least one semantic segment.
 13. Theelectronic device according to claim 10, wherein determining the firstset of semantic segments comprises: searching the multiple semanticsegments into which the set of log files is divided for a fault keyword;and determining the first set of semantic segments based on a searchresult such that each semantic segment in the first set of semanticsegments comprises the fault keyword.
 14. The electronic deviceaccording to claim 10, wherein extracting the key information from thefirst set of semantic segments comprises: extracting the key informationshared among multiple components of the target system from the first setof semantic segments.
 15. The electronic device according to claim 10,wherein extracting the key information specific to the target systemfrom the first set of semantic segments comprises: extracting the keyinformation by searching the first set of semantic segments for at leastone keyword indicating a type of the key information.
 16. The electronicdevice according to claim 10, wherein determining the applicationscenario comprises: determining, based on the extracted key information,a service operation type related to the application scenario; andidentifying the application scenario based on the service operation typeand the key information.
 17. The electronic device according to claim16, wherein determining the at least one log file comprises: determiningat least one component related to the service operation type frommultiple components of the target system; and determining the at leastone log file associated with the at least one component from the set oflog files.
 18. The electronic device according to claim 16, wherein theactions further comprise: extracting a fault code related to theapplication scenario from the first set of semantic segments; generatinga fault profile related to the application scenario based on the serviceoperation type, the key information, and the fault code; and providingthe fault profile while providing the first set of semantic segments andthe second set of semantic segments.
 19. A computer program producttangibly stored in a computer storage medium and comprisingmachine-executable instructions that, when executed by a device, causethe device to perform actions, the actions comprising: determining afirst set of semantic segments comprising fault information frommultiple semantic segments into which a set of log files of a targetsystem is divided; extracting key information specific to the targetsystem from the first set of semantic segments; determining, based onthe extracted key information, an application scenario involved in thefault information and at least one log file related to the applicationscenario in the set of log files, determining a second set of semanticsegments comprising the key information from multiple semantic segmentsinto which the at least one log file is divided; and providing the firstset of semantic segments and the second set of semantic segments byhighlighting the fault information and the key information in the firstset of semantic segments and the second set of semantic segments. 20.The computer program product according to claim 19, wherein the actionsfurther comprise: acquiring multiple log files from corresponding loglocations predefined for multiple components in the target system; andobtaining the set of log files by filtering the multiple log files.